Vulnerability record · CVE-2021-44659 · published 22 December 2021

CVE-2021-44659: Thoughtworks gocd server-side request forgery (ssrf) vulnerability

Thoughtworks · Gocd

Adding a new pipeline in GoCD server version 21.3.0 has a functionality that could be abused to do an un-intended action in order to achieve a Server Side Request Forgery (SSRF). NOTE: the vendor's position is that the observed behavior is not a vulnerability, because the product's design allows an admin to configure outbound requests

9.8 CVSS 3.1 Critical EPSS 2.5% · top 15.8% CWE-918 · Server-side request forgery (SSRF)

9.8CVSS 3.1 base score, v2 7.5

2.5%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

8References, 4 tagged exploit

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Gocd Thoughtworks

References

Link	Tags
https://github.com/Mesh3l911/CVE-2021-44659	Broken LinkExploitThird Party Advisory
https://github.com/gocd/gocd	ProductThird Party Advisory
https://www.gocd.org/	ProductVendor Advisory
https://youtu.be/WW_a3znugl0	ExploitThird Party Advisory
https://github.com/Mesh3l911/CVE-2021-44659	Broken LinkExploitThird Party Advisory
https://github.com/gocd/gocd	ProductThird Party Advisory
https://www.gocd.org/	ProductVendor Advisory
https://youtu.be/WW_a3znugl0	ExploitThird Party Advisory

Track CVE-2021-44659 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2021-43290Thoughtworks gocd path traversal vulnerabilityAn issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into a directory…EPSS 3.2%14 Apr 2022 9.4CVE-2024-56320Thoughtworks gocd improper authorization vulnerabilityGoCD is a continuous deliver server. GoCD versions prior to 24.5.0 are vulnerable to admin privilege escalation due to improper authorization of acce…EPSS 0.74%3 Jan 2025 8.8CVE-2022-39311Thoughtworks gocd deserialization of untrusted data vulnerabilityGoCD is a continuous delivery server. GoCD helps you automate and streamline the build-test-release cycle for continuous delivery of your product. Go…EPSS 1.7%14 Oct 2022 8.8CVE-2022-29184Thoughtworks gocd command injection vulnerabilityGoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit …EPSS 3.8%20 May 2022 8.8CVE-2021-43286Thoughtworks gocd command injection vulnerabilityAn issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker with privileges to create a new pipeline on a GoCD server can abuse a command…EPSS 2.9%14 Apr 2022 8.8CVE-2021-25924Thoughtworks gocd cross-site request forgery vulnerabilityIn GoCD, versions 19.6.0 to 21.1.0 are vulnerable to Cross-Site Request Forgery due to missing CSRF protection at the `/go/api/config/backup` endpoin…EPSS 0.75%1 Apr 2021 7.5CVE-2021-43289Thoughtworks gocd path traversal vulnerabilityAn issue was discovered in ThoughtWorks GoCD before 21.3.0. An attacker who has compromised a GoCD agent can upload a malicious file into an arbitrar…EPSS 2.3%14 Apr 2022 7.5CVE-2021-43287Thoughtworks gocd information exposure vulnerabilityAn issue was discovered in ThoughtWorks GoCD before 21.3.0. The business continuity add-on, which is enabled by default, leaks all secrets known to t…EPSS 28%14 Apr 2022

Source: NIST National Vulnerability Database (record CVE-2021-44659), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.